CVE-2021-27762

CVE-2021-27762 describes misconfigured security-related HTTP headers resulting in missing or misconfigured headers in web responses. Documented impact per CVSSv3.1 shows a high/severe impact on confidentiality, integrity, and availability (C/H/I/A = HIGH). The root cause is misconfigured/missing ...

PT-2022-9851

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue involves misconfigured security-related HTTP headers, where several security-related headers were missing or mis-configured on the web responses. Recommendations At the...

CVE-2021-27762: Undefined Security Weakness

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses...

phpMyAdmin HTTP Response Splitting Vulnerability

CRLF injection vulnerability in bsdispasmimetype.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the 1 ctype and possibly 2 filetype parameters...

Mortbay Jetty CRLF Injection Vulnerability

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Joomla! vulnerable to CRLF injection

CRLF injection vulnerability in Joomla! before 1.0.13 aka Sunglow allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting XSS attacks. NOTE: some of...

Internet Bug Bounty: CVE-2022-27776: Auth/cookie leak on redirect

Summary: curl/libcurl can be coaxed to leak Authorization / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side for example by...

Huawei EulerOS: Security Advisory for ceph-common (EulerOS-SA-2022-1525)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-25751

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25751

CVE-2022-25751 affects Siemens SCALANCE X-300/XR324/X408-2/X320 etc. devices; root cause is improper validation of HTTP headers in the embedded web server, enabling an unauthenticated remote attacker to crash affected devices. Affected families include X-302/X-304/X-306/X-307/X-308/X-310/X-320/XR...

PT-2022-3570

Name of the Vulnerable Software and Affected Versions SCALANCE X302-7 versions SCALANCE X304-2FE version SCALANCE X306-1LD FE version SCALANCE X307-2 version SCALANCE X307-3 version SCALANCE X307-3LD version SCALANCE X308-2 version SCALANCE X310 version SCALANCE X320-1 version SCALANCE X408-2...

Inconsistent Interpretation of HTTP Requests in twisted.web

The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230: 1. The Content-Length header value could have a + or - prefix. 2. Illegal characters were permitted in chunked extensions, such as the LF \n...

GHSA-C2JG-HW38-JRQQ Inconsistent Interpretation of HTTP Requests in twisted.web

The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230: 1. The Content-Length header value could have a + or - prefix. 2. Illegal characters were permitted in chunked extensions, such as the LF \n...

CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

Cross site scripting

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

CVE-2022-26616

CVE-2022-26616 affects PKP Vendor Open Journal System versions 2.4.8 through 3.3.8. The vulnerability is a reflected cross-site scripting (XSS) flaw exploitable via crafted HTTP headers, allowing an attacker to inject script that is reflected in the user’s response. Connected sources (Red Hat, NV...

PT-2022-17956

Name of the Vulnerable Software and Affected Versions PKP Vendor Open Journal System versions 2.4.8 through 3.3.8 Description The issue allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers. This can potentially lead to unauthorized access or control of...

CVE-2022-26616: Improper Neutralization of Input During Web Page Generation

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...